ConnectWise · ScreenConnect
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
Was es ist
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker
the ability to execute remote code or directly impact confidential data or critical systems.
CISA: ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
Was zu tun ist
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Frist für US-Bundesbehörden: 12. Mai 2026
Weitere ausgenutzte Schwachstellen von ConnectWise
| Hinzugefügt | Schwachstelle | Produkt | Schweregrad | Angriffswahrscheinlichkeit |
|---|---|---|---|---|
| 11.09.2026 | Improper Privilege Management and Missing Authorization | ScreenConnect | Kritisch 9,9 | 0,9% |
| 02.06.2025 | Improper Authentication | ScreenConnect | Hoch 8,1 | 3,6% |
| 22.02.2024 | Authentication Bypass | ScreenConnect | Kritisch 10,0 | >99,9% |
Quellen: Known Exploited Vulnerabilities (CISA, gemeinfrei), CVE records (cve.org) und EPSS (FIRST). Die Angriffswahrscheinlichkeit ist die EPSS-Schätzung, dass jemand in den nächsten 30 Tagen versucht, die Schwachstelle auszunutzen.